Deploy Prod #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Prod | |
| on: | |
| workflow_run: | |
| workflows: | |
| - Build Prod | |
| branches: | |
| - main | |
| types: | |
| - completed | |
| # Allow manual execution from the Actions tab | |
| workflow_dispatch: | |
| jobs: | |
| deploy-prod: | |
| runs-on: ubuntu-latest | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| ref: main | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: v4.0.0 | |
| - name: Import secrets from Vault | |
| id: import_secrets | |
| uses: hashicorp/vault-action@v2.8.0 | |
| with: | |
| url: https://vault.basedosdados.org | |
| token: ${{ secrets.VAULT_TOKEN }} | |
| secrets: | | |
| secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID | GCP_PROJECT_ID ; | |
| secret/data/gcp_credentials/basedosdados-dev GH_ACTIONS_SA | GCP_SA ; | |
| secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME ; | |
| secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE ; | |
| - name: Setup Google Cloud CLI | |
| uses: google-github-actions/setup-gcloud@v0.2.1 | |
| with: | |
| service_account_key: ${{ steps.import_secrets.outputs.GCP_SA }} | |
| project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }} | |
| export_default_credentials: true | |
| - name: Get GKE credentials | |
| uses: google-github-actions/get-gke-credentials@v0.2.1 | |
| with: | |
| cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }} | |
| location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }} | |
| credentials: ${{ steps.import_secrets.outputs.GCP_SA }} | |
| - name: Write values.yaml file | |
| run: | | |
| cat << EOF > values.yaml | |
| chatbot: | |
| name: chatbot-api-prod | |
| image: | |
| name: ghcr.io/${{ github.repository }} | |
| tag: prod | |
| pullPolicy: Always | |
| replicas: 1 | |
| resources: | |
| requests: | |
| cpu: 250m | |
| memory: 1Gi | |
| limits: | |
| cpu: 500m | |
| memory: 2Gi | |
| envConfigMap: chatbot-api-prod-config | |
| envSecret: chatbot-api-prod-secrets | |
| envSharedSecret: api-prod-secrets | |
| EOF | |
| # NOTE: --server-side=false disables Helm v4's Server-Side Apply (SSA) and uses | |
| # Client-Side Apply (CSA) instead, which mirrors Helm v3 behavior. This is simpler | |
| # for single-manager setups: fields removed from the template are deleted from the | |
| # cluster, and there are no field ownership conflicts. | |
| - name: Deploy using Helm | |
| run: | | |
| helm upgrade \ | |
| --wait \ | |
| --install \ | |
| --timeout 10m \ | |
| --namespace website \ | |
| --values values.yaml \ | |
| --server-side false \ | |
| chatbot-api-prod charts/basedosdados-chatbot |